diff options
| author | Luca Bruno <lucab@debian.org> | 2017-02-21 17:08:43 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2017-02-21 17:08:43 -0500 |
| commit | 50ed5c1e6eeb01a96448cb58cb8481e4150d3383 (patch) | |
| tree | 149b716acc51449ff8f1056e0a85ef37b41fb109 | |
| parent | 0d48b8ef05079ee2e0928af9aac3e9c9054dd50e (diff) | |
| download | libseccomp-50ed5c1e6eeb01a96448cb58cb8481e4150d3383.tar.gz | |
man: clarify syscall number rewriting
In case of multiplexed syscalls, syscall name resolver and rule builder
both offer additional functions to ignore or perform syscall number
rewriting.
This commit introduces additional explicit details to the corresponding
manpages.
Signed-off-by: Luca Bruno <lucab@debian.org>
[PM: minor man-page style fixes]
Signed-off-by: Paul Moore <paul@paul-moore.com>
(imported from commit a66f000de92c7ced17ae6615837dabafd803ae42)
| -rw-r--r-- | doc/man/man3/seccomp_rule_add.3 | 5 | ||||
| -rw-r--r-- | doc/man/man3/seccomp_syscall_resolve_name.3 | 16 |
2 files changed, 18 insertions, 3 deletions
diff --git a/doc/man/man3/seccomp_rule_add.3 b/doc/man/man3/seccomp_rule_add.3 index 681286f..8cac4df 100644 --- a/doc/man/man3/seccomp_rule_add.3 +++ b/doc/man/man3/seccomp_rule_add.3 @@ -53,8 +53,8 @@ functions all add a new filter rule to the current seccomp filter. The and .BR seccomp_rule_add_array () functions will make a "best effort" to add the rule as specified, but may alter -the rule slightly due to architecture specifics, e.g. socket and ipc functions -on x86. The +the rule slightly due to architecture specifics (e.g. internal rewriting of +multiplexed syscalls, like socket and ipc functions on x86). The .BR seccomp_rule_add_exact () and .BR seccomp_rule_add_exact_array () @@ -290,5 +290,6 @@ Paul Moore <paul@paul-moore.com> .\" ////////////////////////////////////////////////////////////////////////// .SH SEE ALSO .\" ////////////////////////////////////////////////////////////////////////// +.BR seccomp_syscall_resolve_name_rewrite (3), .BR seccomp_syscall_priority (3), .BR seccomp_load (3) diff --git a/doc/man/man3/seccomp_syscall_resolve_name.3 b/doc/man/man3/seccomp_syscall_resolve_name.3 index 670fcd2..3c0f789 100644 --- a/doc/man/man3/seccomp_syscall_resolve_name.3 +++ b/doc/man/man3/seccomp_syscall_resolve_name.3 @@ -30,7 +30,12 @@ and functions resolve the commonly used syscall name to the syscall number used by the kernel and the rest of the libseccomp API, with .BR seccomp_syscall_resolve_name_rewrite() -rewriting the syscall number for architectures that modify the syscall. The +rewriting the syscall number for architectures that modify the syscall. Syscall +rewriting typically happens in case of a multiplexed syscall, like +.BR socketcall (2) +or +.BR ipc (2) +on x86. .BR seccomp_syscall_resolve_num_arch() function resolves the syscall number used by the kernel to the commonly used syscall name. @@ -100,6 +105,15 @@ out: .SH NOTES .\" ////////////////////////////////////////////////////////////////////////// .P +In case of bare syscalls implemented on top of a multiplexed syscall, +.BR seccomp_syscall_resolve_name() +and +.BR seccomp_syscall_resolve_name_arch() +can be used to verify if a bare syscall is implemented for a specific +architecture, while +.BR seccomp_syscall_resolve_name_rewrite() +can be used to determine the underlying multiplexed syscall. +.P While the seccomp filter can be generated independent of the kernel, kernel support is required to load and enforce the seccomp filter generated by libseccomp. |